Cities under Siege: Mass Casualty Urban Terrorism Assaults

This article is external pageoriginally publishedcall_made by the external pageS. Rajaratnam School of International Studies (RSIS)call_made on 5 May 2016.

Executive Summary

Cities around the world have come under siege from a new kind of terrorism: assault by well-trained and motivated “terrorist commandos” whose primary goal is to cause as much death among civilians as possible. Such has been the case in a number of key attacks in recent years: Mumbai (2008), Nairobi (2013), and Paris (November 2015). The trio selected above for study here represent the deadliest and most extensively analysed incidents of this new type of urban terrorism. This study will address the factors behind these attacks: reasons, methods and characteristics of the attacks, the government responses, and consequences or fallout. It will also include a brief assessment of whether Singapore can be a target of a major assault by “terrorist commandos.”

Introduction: Situating the City in the Spectrum of Violence

Cities around the world have come under siege from a new kind of terrorism: assault by well- trained and motivated “terrorist commandos” whose primary goal is to cause as much death among civilians as possible. Such has been the case in a number of key attacks in recent years: Mumbai (2008), Nairobi (2013), and Paris (November 2015). There are other cases such as the Chechen terrorist assaults in Moscow and other locales in Russia and the Islamic State (IS) terrorist attack in Brussels in March 2016.[1] The trio selected above for study here, however, represent the deadliest and most extensively analysed incidents of this new type of urban terrorism. This study will address the factors behind these attacks: reasons, methods and characteristics of the attacks, the government responses, and consequences or fallout. It will also include a brief assessment of whether Singapore can be a target of a major assault by “terrorist commandos.”

Cities have constituted the foundation of settled human civilisation.[2] They first arose historically as protective or defensive structures for a community or a society against land-based attacks by marauders or enemies. Cities had the advantages of large concentrations of people and walls to hold off attack thus ensuring that it was better to be in a city than alone in the hinterland where marauders and invaders could loot, ravage, and pillage unprotected communities and villages.[3] Cities are important because they have the highest density of population within a territorial entity and they are the locus of most human social activity within societies. They are the centres of gravity for cultural and socio-economic activities and of politics. By 2030, around 60 per cent of the global population will live in cities and towns, with nearly all of this growth occurring in the Global South.[4]

Cities have not been strangers to nature’s fury or man’s capacity for violence. They have either withstood or succumbed to a wide variety of structural or environmental catastrophes—famine, plague, flooding, and fire—and to mankind’s almost infinite capacity for inflicting violence on itself and its property. Taking a city or paralyzing it has been an important military goal throughout history, even though militaries have often been loath to directly assault defended cities because of the vast expenditure of personnel, time, and resources. Cities have suffered from sieges, revolutions, coups d’états, and sustained urban combat between regular military forces. They have been the targets of organised criminal networks and of large violent gangs in many countries, whether it is in the Global North—the developed world—or the Global South—the developing world. Lastly, cities have been the targets of terrorist groups. There have been multiple ways in which terrorists have “terrorised” cities but none have been as deadly as the tactics, techniques and procedures (TTPs) of mass casualty urban terrorist assaults (MCUTA) as those that have occurred in Mumbai, Nairobi, and Paris. This paper will address MCUTA and their TTPs.

Definitions and Clarifications: Terrorism, Insurgency and Urban Insurgency and Urban Terrorism

An extended discussion of the differences between terrorism and guerrilla warfare/insurgency and on the differences between urban terrorism and urban guerrilla warfare is not possible here. It suffices to state a few propositions here that may hopefully clarify what this paper will focus on. Terrorism is the premeditated use or threat to use violence by individuals or subnational groups against innocent civilians in order to force governments to bend to the terrorists’ will. Cities have emerged as the preferred targets of terrorism. To paraphrase what an American gangster, Willy Sutton, said when asked why he robbed banks and answered: “because that is where the money’s at.” Similarly terrorists attack cities because that is where the lucrative targets are. Terrorism has been overwhelmingly an urban phenomenon— and has been characterised by the emergence of small groups of radicalised individuals undertaking acts of sabotage, assassination, kidnapping, and killing of innocent civilians to make a political point vis-à-vis the government. Cities are now without protective walls as in the past, and the lucrative targets within them makes them attractive to assault.[5]

In summer 2015, several journalistic analyses appeared discussing the cities most likely to be the targets of terrorist attacks in the coming years.[6] The relevance of the discussions was further highlighted by the stunning terrorist assaults on separate targets in Paris in November 2015, which killed 130 people in the worst act of terrorism in Europe since the bombings in Madrid in 2004. Four months later, a group from IS attacked Brussels airport—Zvantem—and a downtown metro station. These were not as deadly as the Paris attackers, nonetheless 35 people were killed and the attacks caused a gaping wound in the fabric of an already fragile society. David Kilcullen, a specialist who has written extensively on and participated in wars, believes that cities are under assault: “The goal is to shut [cities] down for as long as possible, separate people from one another, break down communities, and push them into mental fortresses.”[7]

An insurgency is an uprising by a disgruntled group of people traditionally located in a rural environment. Historically, the insurgent organisation builds a sanctuary, seeks to draw people to its side, and conducts guerrilla warfare— hit-and-run, raids, ambushes, destruction of infrastructure, assassinations, and selective terrorism against opponents whether within the movement itself in order to rid it of troublesome individuals or against representatives of the state.

In reality, the lines between (rural) insurgency and (urban) terrorism were never as clear-cut. In the 1920s, when the Irish fought their war of independence against the British, they set up an urban force whose mission was to unravel British control of the cities and deny them intelligence about the Irish Republican Army. They also had a larger rural fighting force (“Flying Columns”) whose mission was to hunt small units of British security forces in a fight for control of the hinterland.[8]

During the Vietnamese War of Independence against the French in the 1950s, the Vietcong built an army but they also conducted a short- lived urban terrorism campaign in Saigon under a commander named Nguyen Binh.[9] During the Algerian War of Independence in the 1960s, the insurgents built a professional army, a guerrilla force fighting in the mountains, and an urban terrorist outfit that waged terrorism in the capital, Algiers. The French took the terrorist infrastructure down in a painstaking operation.

During the 1960s and 1970s, insurgents in most cases fought in very hostile and treacherous terrain in rural areas throughout the world. However, some urban terrorist groups devoted resources to thinking about and practicing urban insurgency. Urban insurgency represented an attempt by terrorist groups to conduct a form of “super-empowered” terrorism, which would rely on the terrorists setting up an infrastructure to maintain themselves within the urban environment through safe-houses and sanctuaries (that could be mobile or moved quickly due to the power of the state apparatus) and a capability to wage sustained combat operations against security forces rather than merely indiscriminate terrorist actions, as was the norm previously. In contemporary times, Islamist militant groups have taken up the search for effective urban insurgency practice.[10]

The purpose of this study is to address a particular terrorist modus operandi, the Mass Casualty Urban Terrorist Assault (MCUTA), which is executed against a specific soft target or set of separate soft targets within an urban area by highly trained and prepared suicide assault teams or “terrorist commandos.” The political goals are not to negotiate over a specific set of demands that the terrorists expect the government to implement immediately, rather they are to highlight to the government the “negative consequences” of its foreign/security and domestic policies, to exploit fissures within the society—particularly if it is multi-national and multi-confessional—and polarise inter-ethnic and inter-religious relations within the society.

The prime operational goal is to cause as much mayhem by killing as many people as possible—the victims are not hostages but “doomed captives.” The second operational goal is to ensure that the attackers are able to hold off the forces of the government for as long as possible so that they can: (i) kill as many people as they are able to; (ii) gain as much media mileage of their butchery; and (iii) highlight government ineptitude. The tertiary goal is to take advantage of existing vulnerabilities—actual or latent, obvious or even concealed— within the target city and thus cause as much polarisation as possible by the attacks on that society’s centre of gravity: an iconic city or capital.

Case Studies of Mass Casualty Urban Terrorist Assaults

Each case in this study will proceed along the following lines: (i) why was that particular city and country attacked; (ii) how did the attack proceed in terms of tactics, techniques and procedures and how did the government forces respond to the assault; and (iii) did the government have any prior warnings and indicators?

One of the case studies, Nairobi (2013), deals with a complex attack by heavily armed squads on one specific target set: a busy mall. The other two attacks Mumbai (2008) and Paris (November 2015) were complex simultaneous attacks on multiple targets: restaurants, bars, stadiums, concert hall, train station, religious centre, and hotels.

The Assaults on Mumbai, 2008

The 26 November 2008 terrorist attack in Mumbai, which killed at least 172 people, has been called “India’s 9/11.” The attack was bold, complex, targeted multiple locations simultaneously, and lasted three days.[11] The duration of the attack—almost three days in the full view of the world’s media—itself was a significant milestone. Lashkar-e-Taiba (LeT), a radical Islamist terrorist group based in Pakistan, was responsible for the attack.

Why Mumbai? Many Pakistan-based terrorists see Hindu-majority India as an enemy of Islam. LeT has declared that its objective is not merely liberating Kashmir—a region currently split between India and Pakistan—but breaking up India. A terrorist attack on India exacerbates religious antagonisms between India’s Hindu majority and its Muslim community provoking Hindu reprisals that Islamist extremists hope would polarise India and facilitate recruitment of Muslims to their cause.[12] Mumbai is India’s commercial and entertainment centre—“India’s Wall Street, its Hollywood, its Milan.”[13] The Taj Mahal Palace and Trident-Oberoi Hotels, landmark institutions, were filled with foreigners and the local elite. LeT probably hoped that the negative international publicity would result in damage to India’s economy. The Mumbai attacks were well planned by LeT, which was allegedly helped by the highly professional intelligence arm, the Inter-Services Intelligence (ISI) of a state sponsor, Pakistan.[14] An American of both Pakistani and American heritage, David Headley, claimed from prison in the United States that there was coordination between ISI and LeT. He travelled to Mumbai on eight separate occasions to conduct a “recon” of the Mumbai targets. His videos and descriptions of the iconic Taj hotel were used to build up a mock-up for the assault team then in training.[15] The planning for the attack itself began in 2006. LeT engaged in thorough preparation of the assault team, both physical and mental, in a training camp in Muzzaferabad in Pakistani Kashmir. The terrorists were given pre-planned routes through the city from the point of their landing in Mumbai to their final objective. The LeT trainers provided the assault team with maps and images of their targets in a compact disc. Guided by their controllers in Pakistan, the trained terrorists made their way by sea from Pakistan, evaded Indian coastal patrols, transferred from their vessels to an Indian fishing vessel that they seized and made landfall in Mumbai in a closed fishing community. Their sudden arrival aroused suspicion but nothing was done and they proceeded to unleash carnage on the city in two-man teams.

The Indian response was slow, piecemeal, and confused. The various agencies involved in responding to the terrorist assault were unable to coordinate with one another. Despite the number of terrorist attacks India has suffered over the years, Mumbai did not seem to have protocols in place for dealing with a major terrorist event. Moreover, the Indian police units that initially responded were simply outgunned due to inadequate training and lack of requisite firearms.[16] There were tussles between the state in which Mumbai is located and the centre, New Delhi, over turf and who had authority over the response. The result was that the centrally controlled National Security Guards (NSG) did not receive the orders to mobilise for hours and then had to wait for transport before they could be deployed to fight the terrorists.[17]

The terrorist attack on Mumbai is also noteworthy for the enormous amount of chatter it generated on jihadist websites. The chatter was mainly about the tactics, techniques and procedures of the terrorists and about the perceived weaknesses of the responding government agencies. One jihadist website, the al-Yaqin Media Center, released a study titled “The Mumbai Operations: A Study in the Local, Regional, and International Ramifications.”[18] The study is worth examining in summary form as the author or authors were profoundly impressed by a number of factors ranging from the politico-strategic to the operational and tactical. The study noted that:

• The jihadists/terrorists split into “small units that simultaneously hit numerous targets. Some were to spread fear and chaos within the city, while the others took foreign hostages…”
• The operation in Mumbai reflected “high level of planning” and demonstrated the attackers “high level of training.”
• The attackers did not have to use car bombs (VBIEDs) or suicide belts. The attackers constituted a highly trained assault team divided into smaller two man teams. The study referred to it as a commando operation, which was rare in jihadist operational annals.
• The attacks “were considered a serious blow to the reputation of the Indian security forces… It revealed the weakness of the organisation and its lagging behind in the arming, training, and technology fields.” The study knew a significant amount about Indian security weaknesses. “This giant police structure…” is weak because India does not have enough police. Its capabilities are deficient due to lack of training and antiquated weaponry: “From the arms aspect, it is still living in the time of the English occupation of India, where most of the police weapons are rifles used in the English army during the fifties [presumably referring to the bolt-action .303 Lee Enfield rifle].

There was plenty of information that terrorists were planning something in Mumbai. In February 2008, a suspected terrorist arrested in northern India, was found to possess drawings of various iconic sites in Mumbai, some of which were targets in the November 2008 attack. The suspect indicated that he had begun his reconnaissance in late 2007. On September 24, India’s Intelligence Bureau (IB), issued a warning that LeT was showing unusual interest in Mumbai and listed six potential targets of the group.

By late October 2008, Great Britain and the United States also suspected something untoward was about to happen and while they did exchange information with India, the three countries did not communicate extensively with one another until the terrorist operation was underway. Since September 2008, Great Britain had amassed considerable information about the online activities of one Zarrar Shah, the “technology chief” of LeT who was using Google Earth to map out the routes for the assault team from their landing site into the city and who was searching for “4 and 5 star” hotels in Mumbai. This did not find its way to the Indians because according to the British, Shah’s activities did not show intent to do anything specific. By October 2008, the U.S. Central Intelligence Agency had already provided India with some vital tip-offs, including the fact that terrorists planning to attack Mumbai might arrive by sea.[19] The three countries were not able to connect the dots by themselves and did not communicate and collaborate with one another, which might have allowed them to put together the pieces of the puzzle.[20]

The Assault on Westgate Mall, Nairobi 2013[21]

Around 12:30 on Saturday, 21 September 2013, closed circuit television (CCTV) footage inside the Westgate Mall in Nairobi, Kenya showed two armed individuals entering the mall through the main entrance while two others made their way up a ramp to the rear parking deck. The Westgate mall is located in the affluent Westlands district of Nairobi, approximately 3.5 kilometres northwest of the city centre. The area is home to the capital’s expatriate population, and the mall is popular with foreigners and middle-class Kenyans making it a lucrative target for the attackers.

The formal claim of responsibility issued by al-Shabaab leader, Ahmed Abdi Godane, on 25 September 2013, stated that the Westgate attack was revenge for Kenya’s policies, specifically as a legitimate response to Kenya’s invasion of Somalia. Godane told the Kenyan people they were targeted “because it’s you who have chosen your politicians...it’s you who have supported your government’s decision to go to war.” Damaging its economy was a specific objective. al-Shabaab claimed the attack was “a slap in the face of the dwindling economy of the Kenyan government,” and warned that it would bring about Kenya’s “economic downfall” if Kenyan forces failed to withdraw from Somalia.

The attackers were armed with pistols, fully automatic AK-47 assault rifles and hand grenades. When the terrorists encountered civilians in the mall, they began shooting and lobbing grenades indiscriminately. They roamed the mall hunting for those still alive. The terrorists made no attempts to take hostages during the attack. Survivors reported that the attackers walked through the mall, identified themselves as police helping with the evacuation and then executed individuals who revealed themselves. The assault witnessed the extensive use of social media by al-Shabaab. Throughout the event, al-Shabaab’s press office generated Twitter content justifying the attack and mocking the police and military response.

The initial response to the terrorists consisted of a group of armed security guards, armed local citizens, and off-duty members of the security services who were in the mall when the attack took place. Even though this response was disorganised, it helped evacuate and save many people. In a terrorist assault like the one at Westgate, where the terrorists are bent on killing as many people as possible, a response by those who can respond—and the response must be one of attempting to flee or hide—is better than no response at all. Shortly thereafter, members of the Flying Squad, a paramilitary arm of the police that deals with organised crime, arrived because they were under the impression that a gang of criminals was responsible for the on-going mayhem. When they engaged the “criminals,” Flying Squad members found out that they did not have adequate firepower to thwart the terrorists.

Only three and half-hours after the attack began, elements of the General Services Unit (GSU) “Recce Company”—Kenya’s internal anti-terrorism response force—arrived at the Westgate Mall. GSU Officers engaged the terrorists in a firefight and pinned them down inside the Nukumatt Store. Units of the Kenyan Army Ranger Regiment arrived and entered the mall. No command, coordination, and communication system was set up between the police forces already there and the military units that arrived shortly thereafter. Even if it had been set up, it would not have made a difference as soldiers and police officers were equipped with incompatible radio systems. Little or no effort was made by members of the security forces to inform each other of planned assaults on the mall. This may be the reason why a “friendly fire” situation between Rangers/GSU and police occurred claiming the life of one of the GSU “Recce Company” commanders and wounded three other GSU officers. At night, government forces lacking night vision gear, withdrew from the mall into perimeter positions. The militants appear to have used the confusion of the Kenyan forces to regroup and equip themselves with large-calibre weapons that had not featured in the initial phase of the attack. Government forces reported that the terrorists appeared to have hidden caches of ammunition and explosives inside the mall prior to the attack. The pre-positioning of heavier weapons suggests that the militants anticipated a transition to a more defensive posture following their murderous spree. By early Sunday, 22 September, a siege had developed. The following two days brought more firefights. On Tuesday, 24 September, the siege finally came to an end with the storming of the mall by Kenyan forces.

There were warnings that al-Shabaab intended to attack key targets in Nairobi. A year before, a Kenyan government intelligence report warned of a potential attack at Westgate. The briefing, dated 21 September 2012, assessed that the Somali terrorist organisation, al-Shabaab, was planning to target the mall: “The following suspected al-Shabaab operatives are in Nairobi and are planning to mount suicide attacks on undisclosed date, targeting Westgate Mall.”[22] Another intelligence briefing warned of attacks like those that struck Mumbai in late 2008, “Where the operatives storm into a building with guns and grenades and probably hold hostages.”[23] On 26 September 2013, Kenyan newspapers cited a leaked National Intelligence Service (NIS) report that revealed that the NIS had briefed ministers in January 2013 and again at the beginning of September, about terrorist plans to launch simultaneous terrorist attacks in Nairobi and Mombasa around September. The NIS warned that al-Shabaab was planning to carry out suicide attacks on targets including the Westgate Mall. Another report even named the eventual target, stating, “The following suspected al-Shabaab operatives are in Nairobi and are planning to mount suicide attacks on undisclosed date, targeting Westgate Mall and Holy Family Basilica [church].” It was dated 21 September 2012—exactly one year earlier.[24]

The leak of the 32-page intelligence file, obtained by Al Jazeera, suggested five senior officials— including the secretaries of interior, defence, foreign affairs, and treasury, as well as the chief of defence forces—were aware of imminent threats. The senior officials were briefed on the “noticeable rise in the level of threat” starting on 13 September, eight days before the Westgate attack. Several security analysts told Al Jazeera that institutional rivalry and unclear command lines within Kenyan security agencies were the likely reasons behind the failure to foil the Westgate strike. The Kenyan intelligence service has become politicised and appear to be more focused on neutralising political opponents, rather than protecting the country from internal and external aggression.[25]

The security crackdown that unfolded in the wake of the attack created a climate of fear and distrust among many of the country’s Muslims. The homes of ethnic Somalis in Nairobi’s Eastleigh—a neighbourhood of more than a million ethnic Somalis—became frequent targets of police raids. For the ethnic Somalis, the harassment has succeeded only in turning residents further against the police. In the coastal city of Mombasa—which has a large Muslim population—relations between Muslims and Christians deteriorated significantly in the wake of the attack. The mall attack and its aftermath has deepened Kenya’s ethnic and political divisions, fomenting unrest in a country long seen as an icon of stability in increasingly volatile East Africa.

Paris Attacks of November 2015

On Friday, 13 November 2015, eight IS operatives divided into three teams attacked seven different locations, murdering at least 130 and wounding at least 352 in less than 60 minutes. While IS has made clear that Europe in general is a target for the group, France has always been of particular interest for jihadist terrorists. IS seems to have a particular hatred for France, made very clear in a French-language article entitled “L’ Histoire de l’Inimite de France envers l’Islam” or the History of French Hatred of Islam. The article describes the days of the first Crusades (1096- 1099) when the French Pope Urban II urged the nobles of France to go “fight Islam” in the Holy Land. For IS, France’s secular and democratic values were anathema as was its presence in the Middle East and North Africa where it was first a colonial power and later, provided support to local governments fighting extremists. France’s military was already involved in airstrikes against IS positions in Syria before the November 2015 terrorist attack. IS relied on the extensive number of French or Belgian-born jihadists who had  gone to fight overseas and on logistics networks in both countries.[26] IS hope that attacks by French-born militants on home-soil would vex the French government and force it to commit scarce resources to security rather than economic recovery. The attacks would provoke France into taking harsh security measures that would target the Muslim population in the hope that this would engender the growth of radicalisation of Muslims and political polarisation within French society.

The Paris operation in November 2015 targeted the following locales:

Stade de France: One team of three operatives detonated their suicide belts outside the Stade de France. According to unconfirmed accounts, one suicide bomber allegedly tried to enter the France-Germany football match and detonated his device after being denied entry to the stadium by security. A second suicide bomber detonated himself outside the stadium, while the third detonated himself outside an American fast food restaurant near the stadium. The stadium attacks were the least successful. This trio would not have been able to secure an installation as large as a stadium. Their goal was merely to inflict as many casualties as possible by blowing themselves up. They were also the least well-trained of the terrorist commandos, which is presumably why they were expected to be just suicide bombers and nothing else. If they had penetrated the stadium the terrorists might have been able to inflict a certain amount of casualties but it is not clear how much since their suicide belts contained only a small amount of the explosive TATP.[27]

• Restaurants: Two operatives opened fire on patrons of Le Carillon bar and Le Petit Cambodge restaurant in the city’s 10th district, killing 15 and injuring more than 20. The gunmen then drove to the La Bonn Biere and opened fire, killing another five people before moving onto La Belle Equipe restaurant and killing 19.
• Concert Hall: Three gunmen wearing suicide belts stormed the Bataclan hall during a rock concert, took hostages, and reportedly started executing them, resulting in more than 80 deaths and scores of injuries. One of the operatives detonated his suicide belt, while the final two gunmen were killed in a shoot-out with police. The tactical movements of the attackers observed by survivors at the Bataclan theatre reflected prior training. Two of the shooters sought a high-ground position, possibly on the second level of the theatre, which provided an advantageous position to maximise causalities. Survivors also reported that the operatives maintained a disciplined firing approach: while one operative would reload, another would continue firing to avoid being disrupted and continue the carnage; and when one moved, the other provided covering fire.

The near-simultaneous attacks targeting a stadium, multiple restaurants, and a concert hall in Paris demonstrated a great degree of coordination and use of multiple tactics, resulting in higher casualties than has been seen in any previous IS Western attack.[28] The attackers were equipped with assault rifles and explosive-laden suicide belts, and operated in a manner reflecting prior training. They maintained a high degree of operational security. The attack was planned in Belgium, giving the terrorists opportunities to discuss operational details free of surveillance by French intelligence, which despite its failures in thwarting the terrorist operation is large, more proactive and more capable than its overstretched and undermanned Belgian counterpart. The operatives rented vehicles to move to a forward logistics base in Paris.

Why was a large-scale attack like this, which would have a pre-operational footprint, not picked up by the intelligence services? The intelligence services in France and Belgium knew about the suspects’ backgrounds. Five had travelled to fight in Syria and returned to France or Belgium. One of the attackers at the Stade de France, Omar Ismail Mostefai, had a French police “S” file indicating suspected radicalisation since 2010. He had gone to Syria in 2013 and returned to France in the spring of 2014. Sami Amimour, one of the gunmen at the Bataclan, had been detained in October 2012 on suspicion of terrorist links, and had an international arrest warrant and yet was able to travel to Syria in 2013. He returned in mid-October 2014, and was able to evade surveillance and apprehension until the attacks. Salah Abdeslam, who took on a logistics role, is the brother of one of the terrorists who blew himself up outside the Comptoir Voltaire café. Salah Abdeslam was stopped on the French-Belgian border a few hours after the attack and questioned, but then released. He was only apprehended in late March 2016 in Molenbeek, a Brussels suburb, because he made the mistake of using a mobile that was being tracked by the authorities. Abdel Hamid Abaaoud was operational leader and not the mastermind— the latter was either in Syria or somewhere else in Europe—behind the attack and had been identified as a colleague of two terrorists killed in a shootout at a house in the Belgian town of Verviers in January 2015. His footprints were all over planned or failed attacks in Europe.

François Heisbourg, a former member of a French presidential commission on defence and security, and one of Europe’s leading strategic thinkers, argued that the biggest problem was not a shortage of information about suspects but a lack of capacity to process that information. It was less a failure of intelligence than the ability to follow through on the intelligence data. The terrorists were giving off signals but the French security and intelligence services were inundated with information and were unable to connect the dots.

Failure to analyse the information was not the only problem. French intelligence faces a problem created by the gap between available personnel and the huge number of suspects. French intelligence and police have an estimated of only 500-600 personnel whose task is to follow suspects but the country has about 11,000 people on their books classified as potential threats to national security. An operation to monitor one person 24-hours-a-day requires about 30 to 40 people. They have to make hard choices about which people to focus on.[29] The domestic security service was revamped in 2013 but it is still underfunded and undermanned, and, in any case reform only produces fruit over four or five years.[30]

One of the biggest failings was the long-running lack of cooperation between European intelligence agencies—and reluctance to share information— due to fears about leaks.[31] When they do cooperate, the process is mind-numbingly slow and bureaucratic.[32]

Overall Lessons Learned from MCUTA

During a terrorist commando assault of the types considered above, there is no intent by the attackers to take hostages or negotiate with law enforcement. The longer the attackers remain operational, the more victims will be killed or injured in the attack.

Rapid response by available law enforcement and security forces, even if disorganised as seen in the initial response in both Nairobi and Mumbai, saves lives during the early phase of an active shooter attack. As long as the terrorists remain focused on firefights with responding police, paramilitary, and military units, they have less time to focus on butchering their “doomed captives.” Lightly armed police will invariably often respond first before the “heavy guns” are brought in. There is nothing wrong with them coming in first and setting up a defensive perimeter. These “cops” engaged in firefights with the heavily armed terrorists are unlikely to win and consequently SWAT (Special Weapons and Tactics) teams should not be far behind. Attackers who have advanced, detailed knowledge of a facility will try to use that knowledge to ambush and flank security forces, effectively engaging (and in some cases, pinning down) a far larger group of officers—as was seen during the siege at The Taj Hotel in Mumbai—which is why it is imperative that special police units must respond rapidly.

First responders to an attack of this type must consider the possibility of advanced tactics by the terrorists: (i) ambushes targeted on first responders; (ii) supporting sniper fire; (iii) the possibility of remotely controlled improvised explosive devices emplaced near command posts or staging areas; and (iv) diversionary explosions in vehicles or in public places designed to distract and divert security forces.

Effective command and control measures are essential, including use of the incident command system (ICS). ICS refers to measures used for the command, control, and coordination of an emergency response. It allows agencies to work together using common terminology and operating procedures for controlling personnel, facilities, equipment, and communications at a single incident scene, establishes accountability for all personnel at the scene, and allows planning for counter-assault operations. The planning must take into account all units present and ensure the establishment of interoperable communications between all responders.

Coordination and cooperation stand out as key to the success of the government response. A single organisation cannot tackle major crises alone. The effectiveness of crisis response is to a very considerable extent determined by the breadth and depth of inter-organisational relations in its crisis management systems. Response to the major attacks on soft targets such as resorts, hotels, malls, railroads, etc. requires the collaboration of a wide range of institutions and organisations. Rapid recognition and declaration of a major incident, agreed- upon command and control systems, limited confusion over roles and responsibilities, effective handling of casualties, and coordinated media messages, are critical to the success of the government’s response.

Implications for Singapore

After 9/11 and the launching of the war on terror by the United States and its allies, Southeast Asia was referred to as the “second front” in the struggle against al-Qaeda and its affiliates. There was a flurry of terrorist activity by notorious groups such as Jemaah Islamiyah. They committed a number of atrocities but were eventually foiled by robust counter-terrorism measures, by mistakes made by the terrorists, and by sheer luck due to fortuitous intelligence received about terrorist plans. The threat now is of a different kind and Southeast Asian countries must prepare to thwart or deal with mass casualty urban terrorist assaults (MCUTAs) in the future. IS—based in Syria and Iraq— has developed an extensive set of multi-form capabilities that range from terrorism through guerrilla warfare to semi-conventional warfare capabilities. Within this spectrum of violence, IS has also begun to develop a capacity for MCUTAs, which has benefited from skills, tactics, and procedures developed in targeting Iraqi and Syrian cities and particularly military bases of the Syrian and Iraqi armed forces.[33]

IS has gained adherents at an alarming rate in Southeast Asia. This is not merely limited to those who have gone on to fight as foreign fighters in Syria and Iraq, but it has also extended to those who have stayed at home and might be tempted to engage in violent action against the state or fellow citizens they deem to have deviated from “true Islam.” It is, therefore, not inconceivable that in the not too distant future, the mass casualty urban terrorist assault will hit a city in this sub-region. The assessment here suggests that the following cities in Southeast Asia are under the greatest level of threat: Manila, Bangkok, Jakarta, Kuala Lumpur, and Singapore. They are major capital cities and they are cities of countries with which violent Islamist militants have serious issues.

Can Such Attack Happen in Singapore?

Singapore has paid considerable attention to the threat posed by terrorists to its security. More recently, the potential threat of IS in Southeast Asia has not escaped the attention of the Singapore government. In May 2015, during the Shangri-La Dialogue in Singapore, an event that brought together military and civilian officials from 20 Asia Pacific countries, Singapore’s Prime Minister Lee Hsien Loong made remarks about IS:

• The threat is no longer over there; it is over here. The idea that ISIS can turn Southeast Asia into a province of its worldwide Islamic caliphate is a grandiose, pie-in-the-sky dream. But it is not so far- fetched that ISIS could establish a base somewhere in the region, a geographical area under its physical control like in Syria and Iraq, somewhere far removed from the centres of power of state governments, where the governments’ writ does not run. That would pose a threat to the whole of Southeast Asia.[34]

This belief in a severe threat to Southeast Asia was reinforced by Mr Lee after the Brussels attack when he said on his Facebook page, “It is not a matter of if, but when, that an attack will take place here.” Politically, Singapore is a target because of its pro-Western policy and its involvement in the Persian Gulf in support of the coalition against IS. It is a lucrative soft target rich environment. It has them all: hotels, tourists, resorts, religious sites, multi- national corporations, malls, large expatriate population of Westerners, multi-ethnic and multi-national population whose potential fissures can be exploited.

Organisation, Planning and Execution

While Singapore is a lucrative target, this does not make it an easy target to penetrate. What the perpetrators require is a successful attack. A successful attack is defined here as the ability to execute a surprise attack of sufficient duration to cause maximum casualties under the limelight of the media. Large-scale sabotage (the destruction of infrastructure) in contrast with pure terrorism (the killing of innocent civilians) may be a step too far for a terrorist assault in Singapore. The assessment is that the terrorists would largely focus on the latter in order to kill as many people as possible.

To execute a MCUTA, the terrorists will require elaborate organisation, planning, and surprise execution. One of the key operational goals of the terrorists is to ensure that the authorities are unable to connect the dots of the footprint until after the terror operation has been executed successfully. For the planning of such an attack in Singapore, terrorists will need a maximum of eight to ten individuals who are well trained, well-prepared, and thoroughly familiar with small arms and the tactics and techniques of assaulting “soft targets.” Will this assault team be made up of native Singaporeans, foreigners, or a mix? This is something that the terrorists will have to consider in depth. Whatever the mix of terrorists, they will need to have complete knowledge of the layout of the island and specifically the soft targets to be assaulted. A team that is not part of the assault squad will, in theory, have conducted pre-operational surveillance and reconnaissance beforehand. The assault squad will then have to be briefed on the findings of the pre-operational team.

One of the hardest tasks of a planned operation against Singapore would be the setting up of sanctuaries and safe houses in which to store weapons and make final preparations before the operation. This will not be easy in Singapore where surveillance is quite high and where acquisition and storage of small arms is not readily available. What the terrorists might consider is the establishment of a base of operations across the causeway in Malaysia under the radar of the Malaysian authorities and then, as in the case of the Mumbai attack in India, the landing in Singapore will be tantamount to the launching of the assault. The planners of the terrorist attack might require assistance from sympathisers in Singapore itself because once the terrorists land in Singapore they may need vehicles to transport them to their specific or respective targets. The terrorist planners will focus exclusively on how to infiltrate the terrorists into Singapore and not on how to exfiltrate them from the island. The assault team will be going in with the knowledge that this is a one-way mission.

The terrorists are also faced with developing an effective maritime component of the planned event: how to get the terrorists into Singapore unscathed with their arms and equipment? It is assessed here that the infiltration of an assault team onto Singaporean territory ready to move into the assault will be a difficult operation itself and will require detailed planning and preparation such as acquisition of small vessels to transport the assault team and knowledge of Singaporean coastal surveillance and protection protocols to mention but a few key issues. However, Singapore is not lax about its maritime security and its coastal maritime forces pack a heavy punch in terms of surveillance and capacity to respond.[35]

What is the general course of action (COA) for Singapore to thwart or deal with such a terrorist event? First, Singapore needs to work to prevent such an attack. Though a terrorist organisation is a clandestine one, the effort involved in organising, planning, and executing such an operation always leaves a footprint. This stage of terrorist preparations will likely leave a large footprint, which Singapore security services must be ready to pick up. Prevention is, of course, what states aspire to. It is not always possible to prevent a terrorist attack even though we have already established the fact that terrorists planning havoc almost invariably leave a footprint of some kind. Terrorist attacks often succeed because of failures of analytical imagination within intelligence and police services, a lack of long-term strategic intelligence on the threat, and organisational limitations that prevent any intelligence community from being able to “connect the dots” of the existing intelligence.

Second, if Singapore fails to prevent such a type of attack, it needs to fight successfully against it. What does this mean? Firstly, the kind of chaos in command, control, and coordination exhibited in Mumbai and Nairobi must be avoided. Secondly, it must move to minimise the cost by bringing it to an end as quickly as possible. Authorities will need to plan their response based on the knowledge that the “terrorist commandos” are not undertaking their action as a form of negotiation with the government. The hostages they take are not really hostages but “doomed captives,” whom they intend to kill.

Third, if an attack takes place, authorities need to deal successfully with the fall-out and consequences. This response falls back as much on societal resilience as it does on a proactive approach by the government to prevent a breakdown in society and inter-communal relations. Both the government and Singaporeans of all creeds and races must realise that one of the key goals of the terrorists is to cause polarisation between the communities.

We cannot ignore the possibility that the terrorists might conclude that a major assault on urban Singapore would be infeasible. Singapore’s intelligence and security services must think “outside the box” and go down a checklist of what terrorists might think is operationally feasible and what is not. In this context, IS may decide that a major maritime terrorist event might be their best way to do harm to the country. To be sure, major maritime terrorist events are actually quite rare. Al-Qaeda has written about it and conducted two significant maritime attacks off the coast of Yemen years ago. The most successful terrorist or insurgent organisation with a maritime terrorist capability was the now defunct Liberation Tigers of Tamil Eelam (LTTE), whose capabilities in this domain were eventually defeated by the Sri Lankan Navy in 2009. We cannot discount the fact that IS might choose “to go maritime” in the near future.

When we address the issue of whether a MCUTA can be executed in Singapore, we are entering the realm of speculation. This policy paper was an exercise in trying to heighten awareness in Singapore, getting the requisite authorities to pay attention to this particular operational method and capability that has already been used by terrorists elsewhere.

Conclusion

Mass casualty urban terrorist assaults are the modus operandi of well-organised and resilient terrorist organisations that are functionally specialised and have the resources to engage in such deadly actions. IS is at the “cutting edge” of this type of operation. It has set up an “External Operations Department” within its sprawling Security Department (“Diwan al-Amn”). The purpose of External Ops is to carry out deadly operations like mass casualty urban assaults in hostile territory. The “department” is made up of high-level planners, bomb-makers, financiers, and combat units. The combat units themselves are split into two types: well-trained individuals—the suicide commandos—with combat experience in Syria and Iraq and maybe drawn from the Inghimasi [assault suicide commandos] unit. The Inghimasi are IS’ assault or storm-troops who attack fortified and defended positions. Theirs is often a one-way mission, but they are not suicide bombers. The second and less skilled group consists of those who are provided with very quick and basic training such as that undergone by Reda Hame, an incompetent would-be terrorist—he could not learn how to handle an AK-47 assault rifle— who surrendered to French police in August 2015. The primary mission of this second group is to do suicide missions or attack soft targets by themselves (to give the impression that they are lone wolves). “External Operations” has to rely on a forward logistical network within the target countries, which consists of members or sympathisers who can provide safe houses, supplies, food, cars, acquire the necessary ingredients for explosives, and lastly small arms from organised criminal networks.[36]

The threat posed by a new subsect of terrorist operational art or method, the mass casualty urban terrorist attack (MCUTA), cannot be minimised or underestimated. It is not, however, an insurmountable obstacle that cannot be prevented or dealt with if it occurs. Dealing with a potential or actual MCUTA requires authorities in each target country to pay greater attention to the possibility of such an attack and accordingly engage in the requisite changes that must include bilateral and multilateral coordination and cooperation. The terrorists who have done this in the past have committed appalling blunders that could have thwarted them and prevented large- scale mayhem and destruction. Unfortunately, however, to date the terrorists seem to have blundered less than the authorities.

Notes

[1] The Chechen attacks on targets in Moscow and other locales were also deadly but there is no space to address them here. At the time of writing data on the Brussels attacks are still developing and this event will not be addressed in great detail by itself at this time.

[2] As per the UNICEF study, Violence in the City, urban centres generally are understood as geographic areas in which population density is higher than in surrounding areas. The UN State of the World’s Cities 2006/07 defines an urban agglomeration as the “built-up or densely populated area containing the city proper, suburbs and continuously settled commuter areas,” external pagehttp://www.unicef.org/protection/Violence_call_madein_the_city2_-_WB_Study.pdf  

[3]See Lewis Mumford, The City in History: Its Origins, Its Transformation, and Its Prospects, New York: Mariner Books, 1968.

[4]See William Rosenau, “Every room is a new battle:” The lessons of modern urban warfare,” Studies in Conflict and Terrorism, Vol. 20, No. 4 (1997),pp. 373-374.

[5] W.P.S. Sidhu, “Cities become battlefield of terrorism as world continues to urbanise,” Brookings India, 26 November 2015, external pagehttp://www.call_madebrookings.in/the-new-wave-of-global-terrorism/

[6] Andrew Marszal and Tom Shiel, “Revealed: the world’s cities most likely to be hit by a terror attack,” The Telegraph, 21 May 2015, external pagehttp://www.call_madetelegraph.co.uk/news/worldnews/11616606/Revealed-the-worlds-cities-most-likely-to-be-hit-by-a-terror-attack.html

[7]David Kilcullen cited in Robert Muggah, “Is Urban Terrorism the new normal? Probably,” World Economic Forum, 17 January 2016, external pagehttp://www.call_madeweforum.org/agenda/2016/01/is-urban-terrorism-is-the-new-normal-probably; also see David Kilcullen, “The City as a System: Future Conflict and Urban Resilience,” The Fletcher Forum of World Affairs, Vol. 36, No. 2 (Summer 2012), pp.19-39.

[8] See Maura R. Cremin, “Fighting on Their Own Terms: The Tactics of the Irish Republican Army 1919-1921,” Small Wars and Insurgencies, Vol. 26, No. 6 (2015), pp. 912-936.

[9] See Christopher Goscha, “La guerre par d’autres moyens”: Reflexions sur la guerre du Viet Minh dans le Sud-Vietnam de 1945 a 1951,” Guerres mondiales et conflits contemporains, Vol. 2, No. 206 (2002), pp. 29-57.

[10] This section is based on a reading of key primary sources by guerrillas and terrorists about the nature and characteristics of urban warfare: Abraham Guillen, The Revolutionary Writings of Abraham Guillen, translated and edited by Donald Hodges, New York: William Morrow and Company, 1973; Carlos Marighella, Mini manual of the Urban Guerrilla, and Abdul Aziz Al-Muqrin, Dawrat al-tanfidh wa-harb al-asabat (A Practical Course for Guerrilla War) in Norman Cigar (edited and translated), Al-Qaida’s Doctrine for Insurgency, Washington, D.C.: Potomac Books, 2009.

[11] Sarah J. Watson & C. Christine Fair, “India’s Stalled Internal Security Reforms,” India Review, Vol. 12, No. 4 (2013), pp. 280-299.

[12] “The Lessons of the Mumbai Attack,” RAND

[13] Ibid.

[14] This is a very controversial issue and the claims and counter-claims of India and Pakistan are another story altogether. The assault on Mumbai increased tensions between India and Pakistan, which could have also been part of the terrorists’ strategic objectives.

[15] Sandeep Unnithan, “The Great Headley Chase,” India Today, 22 February 2016, p. 22.

[16] For a dissection of the security services response see Sanjay Badri-Maharaj, “The Mumbai Attacks – Lessons to be Learnt from the Police Response,” Journal of Defence Studies, Vol. 3, No. 2 (April 2009), pp. 145-156.

[17] For a detailed analysis of the failures in India’s response see Angel Rabasa et al. The Lessons of Mumbai, RAND Corporation, Santa Monica, 2009, pp. 9-12.

[18] “Al-Yaqin Media Center Releases Analysis of Mumbai Attacks,” Open Source Center-GMP20090209386004, 6 January 2009, https://www.opensource.gov/portal/server.pt/gateway/PTARGS_0_0_200_240_1019_43/h

[19] Emma Garman, “When India Failed in the Mumbai Terrorist Attacks,” The Daily Beast, 2 November 2013, http://www.thedailybeast.com/articles/2013/11/02/when-india-failed-in-the-mumbai-terrorist-attacks.html

[20] Most of the details about the intelligence failures come from the excellent article by Sebastian Rotella, James Glanz, and David Sanger, “In 2008 Mumbai Attacks, Piles of Spy Data, but Uncompleted Puzzle,” New York Times, 21 December 2014, http://www.nytimes.com/2014/12/22/world/asia/in-2008-mumbai-a

[21] This case study is based extensively on Will Hartley, “Killing spree – Al-Shabaab’s hybrid assault on a Kenyan mall,” Jane’s Intelligence Review, Vol. 25, No. 11 (1 November 2013) and several newspaper articles from the time of the attack and after.

[22] Quoted in Mohammad Yusuf, “Kenyan officials warned of ‘Westgate’ attack,” Al-Jazeera, 1 October 2013; http://www.aljazeera.com/indepth/features/2013/09/kenyan-officials-warned-westgate-attack-2013929122737128930.html

[23] Ibid.

[24] Ibid.

[25] For damning indictments of Kenyan security and intelligence services and the country’s counter-terrorism policy, see Harry Misiko, “How Kenya made itself vulnerable to terror,” Washington Post, 17 June 2014, https://www.washingtonpost.com/news/worldviews/wp/2014/06/17/ how-kenya-made-itself-vulnerable-to-terror; see also Wanjohi Kabukuru, “Kenya: How terrorism is redefining the role of the military,” New African, (October 2014), pp. 28-31; Edward Mogire and Kennedy Mkutu Agade, “Counter-terrorism in Kenya,” Journal of Contemporary African Studies, Vol. 29, No. 4 (2011), pp. 473-491.

[26] For more details, see “L’Histoire de l’Inimite de France envers l’Islam,” Dar al-Islam, No. 2 (Rabi al-Thani 1436), pp. 10-11. Dar al-Islam is the French language magazine of Islamic State.

[27] TATP or Triacetone Triperoxide is an unstable explosive made of easy to get materials. It requires a skilled bomb-maker and “dedicated space” to make it. The greater the amount of ingredients used, the more powerful the explosion, but the more unstable the bomb.

[28] This case study relied heavily on the following reports and accounts: Rukmini Callimachi, Katrin Bennhold and Laure Fourquet, “How the Paris Attackers Honed Their Assault Through Trial and Error,” New York Times, 30 November 2015, http://www.nytimes.com/2015/12/01/world/ europe/how-the-paris-a; Adam Nossiter, “Paris Attacks Spur Emergency Edict and Intense Policing in France,” New York Times, 23 November 2015, http://www.nytimes.com/2015/11/24/world/europe/in-france-some; Victoria Shannon, “Paris Attacks: What We Know and Don’t Know,” New York Times, 14 November 2015, http://www.nytimes.com/2015/11/14/world/europe/paris-attacks-w; Adam Nossiter, Aurelien Breeden and Katrin Bennhold, “Three Teams of Coordinated Attackers Carried Out Assaults on Paris, Officials Say; Hollande Blames ISIS,” New York Times, 14 November 2015, external pagehttp://www.nytimes.com/2015/11/15/world/europe/paris-terorist-acall_made; Rukmini Callimachi, Alissa Rubin and Laure Forquet, “A View of ISIS’s Evolution in New Details of Paris Attacks,” New York Times, 19 March 2016.

[29] Ewen MacAskill, “How French intelligence agencies failed before the Paris attacks,” The Guardian, 19 November 2015, http://www.theguardian.com/world/2015/nov/19/how-french-intelligence-agencies-failed-before-the-paris-attacks

[30] Julian Borger, “French and Belgian intelligence knew Paris attackers had jihadi backgrounds,” The Guardian, 16 November 2015, http://www.theguardian.com/world/2015/nov/16/french-and-belgian-intelligence-knew-paris-attackers-had-jihadi-backgrounds

[31] For an extensive analysis of European Union intelligence failures see Eric Randolph et al. “Paris attacks focus on EU intelligence failures,” Jane’s Intelligence Review, Vol. 28, No. 1 (1 January 2016).

[32] Ibid.

[33] For more on these TTPs see Ahmed S. Hashim, The Caliphate At War: The Ideological, Organisational and Military Innovations of Islamic State, London: Hurst and Company, forthcoming 2016.

[34] Olivia Siong, “ISIS could pose serious threat to whole of Southeast Asia: PM Lee at Shangri-La Dialogue,” 29 May 2015, http://www.channelnewsasia.com/singapore/isis-could-pose-serious/1880506.html

[35] See Ridzwan Rahmat, “Deterrence and diplomacy: Singapore’s twin track for delivering maritime security,” Jane’s Navy International, Vol. 120, No. 3 (1 April 2015); Kelvin Wong, “Singapore navy showcases operational variant of its stealthy, high-speed naval interceptor,” Jane’d Defence Weekly, Vol. 53, No. 3 (25 November 2015).

[36] This is a reconstruction from an immense amount of data on the organisation of Islamic State and the attacks in Paris and Brussels. For more details see Ahmed S. Hashim, The Caliphate At War: Ideological, Organizational and Military Innovations of Islamic State, London: Hurst and Company, forthcoming 2016, Chapter Five.

About the Author

Ahmed Salah Hashim is Associate Professor of Strategic Studies in the Military Studies Programme at RSIS, Nanyang Technological University. He specialises in Insurgency and Counterinsurgency and Terrorism and Counter-Terrorism Studies.